147 matches found
CVE-2026-103752
Unauthenticated Privilege Escalation in Authorizer = 3.15.3 versions...
CVE-2026-103752
The WordPress Authorizer plugin versions
EUVD-2026-90851
Unauthenticated Privilege Escalation in Authorizer = 3.15.3 versions...
CVE-2026-103752 WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Authorizer = 3.15.3 versions...
CVE-2026-81294
abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-81294 CVE-2026-81294 — WordPress WordPress — Authorizer 3.15.1 — Paul Ryan Escalada de privilegios no autenticada en Authorizer = 3.15.1. | ---|--- CVE| CVE-2026-81294 · CVE.org CWE| CWE-266 CVSS| Crítica: 9.8...
Exploit for CVE-2026-81294
abraxaslabs.tech · github.com/abraxas ·&...
CVE-2026-50157
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...
CVE-2026-50157: Use of GET Request Method With Sensitive Query Strings
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...
CVE-2026-54072
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...
EUVD-2026-76187
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...
CVE-2026-54072 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...
CVE-2026-54072
Authorizer , an open-source self-hostable authentication and authorization server, is affected by an unvalidated redirect_uri in its /authorize endpoint prior to version 2.2.1 . When response_type=token or response_type=id_token, the server appends access_token , id_token , and refresh_token as q...
CVE-2026-54072 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...
CVE-2026-54072 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...
CVE-2026-54072: URL Redirection to Untrusted Site
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...
CVE-2026-84173
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...
CVE-2026-81294
Unauthenticated Privilege Escalation in Authorizer = 3.15.1 versions...
CVE-2026-81294
CVE-2026-81294 is an unauthenticated privilege escalation vulnerability in the WordPress Authorizer plugin , affecting versions ≤ 3.15.1 . The flaw allows a remote attacker with no prior access to escalate privileges, rated CVSS 3.1: 9.8 (CRITICAL) — network vector, low complexity, no privileges ...